CVE-2026-56301: Nuxt Information Disclosure Vulnerability

CVE-2026-56301 Overview

CVE-2026-56301 affects Nuxt versions 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7 when running the development server (nuxt dev) on Linux. The framework binds the vite-node Inter-Process Communication (IPC) server to an abstract-namespace Unix socket without permission restrictions. Local users on the same host can enumerate and connect to this socket. Unprivileged co-resident users can then exploit the unprotected module request handler to read arbitrary files such as .env files and Secure Shell (SSH) keys through the Server-Side Rendering (SSR) plugin pipeline. Production builds are not affected because the IPC server only runs during development.

Critical Impact
Local unprivileged users on shared Linux development hosts can read arbitrary files accessible to the Nuxt developer, including secrets, credentials, and SSH keys.

Affected Products

Nuxt 4.0.0 through 4.4.6 (Linux development server)
Nuxt 3.18.0 through 3.21.6 (Linux development server)
Shared Linux hosts running nuxt dev with co-resident unprivileged users

Discovery Timeline

2026-06-23 - CVE-2026-56301 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56301

Vulnerability Analysis

The vulnerability is classified under [CWE-276] Incorrect Default Permissions. Nuxt's development server uses vite-node to compile and serve modules. On Linux, this IPC channel is exposed through an abstract-namespace Unix domain socket. Abstract sockets live in a kernel namespace that ignores filesystem permissions and is visible to every process in the same network namespace.

Any local user can list these sockets via /proc/net/unix and connect without restrictions. Once connected, the attacker sends module resolution requests that the SSR plugin pipeline processes with the privileges of the developer running nuxt dev. The pipeline reads requested files from disk and returns their contents to the caller.

Root Cause

The root cause is the absence of access control on the IPC transport. Abstract Unix sockets do not honor filesystem Access Control Lists (ACLs), and Nuxt did not implement an application-layer authentication check or peer credential validation using SO_PEERCRED. The module request handler also treats any connected peer as trusted, allowing arbitrary file reads through the SSR module loader.

Attack Vector

The attack requires local access (AV:L) and low privileges (PR:L) on the same Linux host where a developer runs nuxt dev. The attacker enumerates abstract sockets in /proc/net/unix, identifies the vite-node IPC endpoint, and connects to it. The attacker then issues module fetch requests referencing sensitive paths such as /home/<user>/.ssh/id_rsa or project .env files. The Nuxt SSR plugin chain resolves these paths and returns their contents to the attacker. Patches were committed in the Nuxt repository (commits 1f9f476 and c293bf9).

For exploitation mechanics and proof-of-concept details, see the GitHub Security Advisory GHSA-534h-c3cw-v3h9 and the VulnCheck Advisory.

Detection Methods for CVE-2026-56301

Indicators of Compromise

Unexpected processes opening connections to abstract Unix sockets owned by node or nuxt developer processes
Unfamiliar processes reading /proc/net/unix shortly before connecting to a vite-node socket
Outbound transfers of .env files, SSH private keys, or other secrets from developer workstations or shared build hosts
Access patterns in shell history showing enumeration of /proc/<pid>/ directories for Node.js processes belonging to other users

Detection Strategies

Monitor connect() syscalls targeting abstract Unix sockets on multi-user Linux hosts using auditd or eBPF instrumentation
Alert on cross-user IPC connections where the connecting User Identifier (UID) differs from the listening process UID
Inspect Nuxt installations to confirm versions and flag any host running vulnerable releases with nuxt dev active

Monitoring Recommendations

Track /proc/net/unix reads by non-root users and correlate with subsequent socket connections
Log file read events on developer home directories targeting .ssh, .env, and credential stores
Review network egress from shared Linux hosts for unusual transfers originating from developer or build-agent accounts

How to Mitigate CVE-2026-56301

Immediate Actions Required

Upgrade Nuxt to version 4.4.7 or later on the 4.x branch, or 3.21.7 or later on the 3.x branch
Stop running nuxt dev on shared, multi-tenant Linux hosts until upgrades are completed
Rotate any secrets, API tokens, and SSH keys that resided on hosts running vulnerable Nuxt development servers
Audit shared development environments and Continuous Integration (CI) runners for vulnerable Nuxt versions

Patch Information

The Nuxt maintainers released fixes in versions 4.4.7 and 3.21.7. The fixes are tracked in commits 1f9f4767a8725104da9bee872bb8d35246f25ae5 and c293bf9503ccb3bc9559bff4a1f592f99063c9ea. Production builds do not run the vulnerable IPC server and require no patching, though upgrading the dependency remains recommended.

Workarounds

Run nuxt dev only on single-user developer workstations where no untrusted local accounts exist
Use Linux user namespaces or containers to isolate the development server from other local users
Bind development servers inside dedicated virtual machines rather than shared bastion or jump hosts
Restrict local shell access on build agents and developer servers to the minimum set of trusted users

bash

# Configuration example: upgrade Nuxt to a patched release
npm install nuxt@^4.4.7
# or for the 3.x line
npm install nuxt@^3.21.7

# Verify the installed version
npx nuxt --version